Assessment Objective

Determine if:

• PM-28a.
  • PM-28a.01
    • PM-28a.01[01] assumptions affecting risk assessments are identified and documented;
    • PM-28a.01[02] assumptions affecting risk responses are identified and documented;
    • PM-28a.01[03] assumptions affecting risk monitoring are identified and documented;
  • PM-28a.02
    • PM-28a.02[01] constraints affecting risk assessments are identified and documented;
    • PM-28a.02[02] constraints affecting risk responses are identified and documented;
    • PM-28a.02[03] constraints affecting risk monitoring are identified and documented;
  • PM-28a.03
    • PM-28a.03[01] priorities considered by the organization for managing risk are identified and documented;
    • PM-28a.03[02] trade-offs considered by the organization for managing risk are identified and documented;
  • PM-28a.04 organizational risk tolerance is identified and documented;
• PM-28b. the results of risk framing activities are distributed to [Assignment: personnel];
• PM-28c. risk framing considerations are reviewed and updated [Assignment: frequency].

Assessment Methods

Examine

• Information security program plan
• privacy program plan
• supply chain risk management strategy
• documentation of risk framing activities
• policies and procedures for risk framing activities
• risk management strategy

Interview

• Organizational personnel (including mission, business, and system owners or stewards
• authorizing officials
• senior agency information security officer
• senior agency official for privacy
• and senior accountable official for risk management)

Test

• Organizational procedures and practices for authorizing, conducting, managing, and reviewing personally identifiable information processing
• organizational processes for risk framing
• mechanisms supporting the development, review, update, and approval of risk framing

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final